Note: This blog is intended for QNX self-hosted environments only, including QNX Everywhere.
Three places on the image hold a CA store: the system CA store, curl and pip. Each must be checked and fixed separately. This post has two parts: Part 1 shows you how to check whether your image is vulnerable, and Part 2 shows you how to fix it.
Part 1: Check whether your image is vulnerable
eMudhra's public "We Have A Problem" website, https://emudhra.we-have-a-problem.com, lets you check whether your image is vulnerable.
1.1 Check the system CA store
Open the Epiphany browser in QNX Developer Desktop and go to . Look at the Does your client still trust the compromised intermediates? table. If every row is green, you're good. If any row is red, you're still vulnerable.
You can also check the version of the ca-certificates-mozilla APK from a terminal:
Version ca-certificates-mozilla-3.131.1-r5 or later is not vulnerable. Anything earlier is still vulnerable.
1.2 Check curl
By default, curl uses its own CA store instead of the system CA store, so you need to check it separately.
Use curl to connect to each of these URLs. If any of them succeeds, curl is still vulnerable. If they all fail with a certificate error, curl is not vulnerable.
Or run this script, which checks all four for you:
1.3 Check pip
Like curl, pip has its own built-in CA store.
The easiest check is to ask pip for its version:
pip 26.2.2 or later is not vulnerable.
You can also check the APK versions:
This should return three packages. If they are all version 26.2.2-r0 or later, pip is not vulnerable. Anything earlier is vulnerable.
Finally, you can have pip try to download a package from one of the compromised URLs provided by the eMudhra site:
Pip will fail regardless of whether you are vulnerable or not. The error message pip produces needs to be examined to actually determine vulnerability.
Vulnerable: pip complains that it can't unpack the downloaded file.
Not vulnerable: pip complains that it can't connect securely to download the file.
Part 2: Fix your image
2.1 Fix the system CA store and pip
One APK upgrade fixes both the system CA store and pip.
- Make sure your target has internet access.
- Open a terminal. You can use the initial welcome screen, QNX Developer Desktop or the serial console.
- Upgrade the APK packages:
Note : The browser should be restarted if it is running after the upgrade for the changes to take effect.
To confirm the fix, repeat checks 1.1 and 1.3 above.
2.2 Fix curl
There are three ways to fix curl, depending on how much you've customised your system. If more than one applies, pick the lowest-numbered one. Whichever you choose, repeat check 1.2 above afterwards to confirm curl is no longer vulnerable.
Option 1: Remove curl's own CA store
Use this option if you've never modified a .curlrc file in a user's home directory. If you don't know what a .curlrc file is, this is the option for you.
It removes the legacy override that makes curl use its own CA store. curl then uses the system CA store, which is kept up to date through APK.
Option 2: Edit .curlrc so curl stops using its own CA store
Use this option if you want to keep one or more .curlrc files in users' home directories.
Edit the .curlrc file in each user's home directory, and remove this line:
If a home directory has no .curlrc file, skip it.
Once you've edited every .curlrc file, delete the files curl no longer uses:
Option 3: Update curl's own CA store
Use this option if you want to keep curl's own CA store. The image includes a script that replaces it with one that isn't vulnerable. You have to run it yourself:
This response means the update worked:
This article was written by Darcy Phipps, Distinguished Software Developer at QNX.
